Draft v0.1.06 of 6 frameworks
Security awareness and training
Personnel receive security training at hire and periodically, including role-based and phishing awareness.
Where it appears
- SOC 2
CC1.4Demonstrates commitment to attract, develop and retain competent individualsCC2.2Internally communicates information necessary to support internal control- PCI DSS 4.0
12.6Security awareness education is an ongoing activity (12.6.1 program, 12.6.2 annual review, 12.6.3 training at hire and annually)- NIST CSF 2.0
PR.ATAwareness and training- ISO 27001:2022
A.6.3Information security awareness, education and training- HIPAA Security Rule
164.308(a)(5)Security awareness and training- NIST 800-53 r5
AT-2Literacy training and awarenessAT-3Role-based training
Evidence auditors usually ask for
A typical starting list. Your assessor's request list is the one that counts.
- Training content and annual schedule
- Training completion records for all personnel, including new hires within the required window
- Role-based training for developers, admins and others with elevated access
- Phishing simulation results, if used
Crosswalks that include this
SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0